WO2015018200A1

WO2015018200A1 - Method and apparatus for upgrading detection engine in firewall device

Info

Publication number: WO2015018200A1
Application number: PCT/CN2014/072541
Authority: WO
Inventors: 李世光; 蒋武
Original assignee: 华为技术有限公司
Priority date: 2013-08-08
Filing date: 2014-02-26
Publication date: 2015-02-12
Also published as: CN104348660B; CN104348660A

Abstract

Embodiments of the present invention provide a method and an apparatus for upgrading a detection engine in a firewall device. The method for upgrading a detection engine in a firewall device comprises: generating a first functional component in a new version according to a software upgrade data packet of the detection engine, and running the first functional component in the new version in the detection engine, so as to detect a first conversation by using the first functional component in the new version; if there is at least one second conversation, detecting a subsequent packet of the second conversation by using a first functional component in an old version until the second conversation ages; and after all second conversations age, destroying the first functional component in the old version. In the embodiments of the present invention, only a functional component needing upgrade is upgraded, and after a conversation ages, a functional component used for detecting the conversation is destroyed, so that resource occupation is small, upgrade efficiency is high, and security detection for existing service traffic is not affected.

Description

Method and device for detecting engine in firewall device This application claims to be filed on August 8, 2013 in the Chinese Patent Office, the application number is 201310344399.0, and the invention is entitled "Augmentation Method and Device for Detection Engine in Firewall Equipment" Priority is hereby incorporated by reference in its entirety. Technical field

The embodiments of the present invention relate to network technologies, and in particular, to a method and an apparatus for upgrading a detection engine in a firewall device.

BACKGROUND A basic requirement of a gateway device is the reliability of the device operation. For example, user traffic is not interrupted by the upgrade of the software version, and the user's service is not affected. For gateway devices such as Next Generation Firewall (NGFW), higher requirements are required. NGFW not only has basic forwarding control functions of traditional firewalls, but also policy control based on applications and users, and performs security detection on application layer traffic flowing through the device according to specific policies. These security detections include intrusion prevention and removal systems (Intrusion Prevention). System, referred to as IPS), Anti-Virus (AV), Uniform Resource Locator (URL) filtering, Data Leak Prevention (DLP), etc.

As the content of application layer traffic on the network changes rapidly, the threat of attacks against application layer services also changes rapidly. In order to be able to detect these threats in a timely manner, it is necessary to ensure that the components on the NGFW device that detect the above threats, such as the threat signature database or the detection engine, can be upgraded in a timely manner. In the prior art, one is that the new detection engine replaces the old detection engine, and the old detection engine will not be available after the upgrade succeeds; the other is that after the new detection engine is successfully loaded, the new detection engine is running. The old detection engine is still used, that is, for a long period of time, multiple detection engines are running simultaneously in the NGFW device.

In the first mode, after the upgrade is complete, the old detection engine is unavailable. To ensure that the traffic flowing through the NGFW device is not affected, the subsequent packet traffic of the session established before the upgrade needs to be bypassed. In fact, the application layer detection for this part of the traffic has expired. If an attack occurs, the NGFW device cannot detect the missed detection. In the second mode, multiple detection engines are running at the same time. The processing resources of the NGFW device are consumed greatly, which affects the efficiency. SUMMARY OF THE INVENTION The embodiments of the present invention provide a detection engine upgrade processing method and apparatus, which are used to reduce the missed detection problem caused by the detection engine upgrade in the prior art.

In a first aspect, an embodiment of the present invention provides a method for upgrading a detection engine in a firewall device, including: generating a new version of a first functional component according to a software upgrade data packet of a detection engine, and operating the detection engine in the detection engine a first functional component of the new version, configured to detect the first session by using the first functional component of the new version, where the first session refers to running the new functional version of the first functional component with the firewall a newly established session of the device;

If there is at least one second session, the first function component of the old version is used to detect subsequent messages of the second session until all the second sessions are aged, and the second session refers to running the The session of the new version of the first functional component has been established with the firewall device;

After all the second sessions are aged, the first functional component of the old version is destroyed.

With reference to the first aspect, in a first implementation manner of the first aspect, after the running the new version of the first functional component in the detection engine, the method further includes:

Receiving a packet, and determining, according to the packet header of the packet, the packet that belongs to the first session or the packet that belongs to the second session;

If the packet belongs to the first session, the first functional component of the new version is used for detection; if the packet belongs to the second session, the first functional component of the old version is used for detection.

With reference to the first implementation manner of the first aspect, in a second implementation manner of the first aspect, if there is at least one second session, using the first functional component of the old version to follow the second session The message is detected until all the second sessions are aged, and includes:

A correspondence between the first functional component of the old version, the second session, and the session state of the second session is established and stored for determining whether all of the second sessions are aged.

With the second implementation of the first aspect, in a third implementation manner of the first aspect, after the receiving the message, the method further includes:

When the flag of the text is the end connection FIN or the connection reset RST, if the 4 艮 If the session is the second session, the session state of the session to which the message belongs is set to an aging state in the corresponding relationship.

In combination with the first aspect, or any one of the foregoing first implementation manners, in the fourth implementation manner of the first aspect, the method further includes:

And if the software upgrade data package further includes an upgrade data package of the at least one second function component, generating a new version of the second function component, and running the new version of the second function component in the detection engine.

In a second aspect, an embodiment of the present invention provides an apparatus for upgrading a detection engine in a firewall device, including:

a installing module, configured to generate a new version of the first functional component according to the software upgrade data package of the detection engine, and run the new version of the first functional component in the detection engine;

a detecting module, configured to detect, by using the new functional component of the new version generated and run by the installation module, the first session refers to running the first functional component of the new version a newly established session of the firewall device;

The detecting module is further configured to: if there is at least one second session, use a first functional component of the old version to detect subsequent packets of the second session, until all the second sessions are aged, The second session refers to a session that has been established with the firewall device when the first functional component of the new version is run;

And the destroying module is configured to, according to the triggering of the detecting module, destroy the first functional component of the old version after all the second sessions are aging.

With reference to the second aspect, in a first implementation manner of the second aspect, the device further includes: a receiving module, configured to receive a packet, and determine, according to a packet header of the packet, that the packet belongs to the first a message of one session, or a message belonging to the second session;

The detecting module is further configured to: if the packet belongs to the first session, apply the first functional component of the new version for detection; if the packet belongs to the second session, apply the old version The first functional component is tested.

With reference to the first implementation of the second aspect, in a second implementation manner of the second aspect, the device further includes:

a storage module, configured to establish and store a correspondence between the first functional component of the old version, the second session, and the session state of the second session, for the detecting module to Whether the second session is aging or not.

In conjunction with the second implementation of the second aspect, in a third implementation manner of the second aspect, the storage module is further configured to:

If the flag of the message received by the receiving module is FIN or RST, if the session to which the message belongs is the second session, the session of the session belongs to the "3⁄4 text" in the corresponding relationship. The session state is set to the aging state.

In combination with the second aspect, or any one of the foregoing second aspects, in the fourth implementation manner of the second aspect, the installing module is further configured to:

The method and device for upgrading a detection engine in a firewall device according to the embodiment of the present invention, by generating a new version of the first functional component according to the software upgrade data packet of the detection engine, and running the first function of the new version in the detection engine a component, configured to detect, by using the new functional version of the first functional component, the first session is a session newly established with the firewall device after running the new functional component of the new version; If there is at least one second session, the subsequent message of the second session is detected by using the first functional component of the old version until all the second sessions are aged, and the second session refers to running the new session. The first functional component of the version has been established with the firewall device; after all the second sessions are aged, the first functional component of the old version is destroyed, because only the corresponding functional component that needs to be upgraded is upgraded. Not the entire detection engine is upgraded, and the old session will be detected after all the second sessions are aged The functional components are destroyed, and the resource consumption is small and the upgrade efficiency is high compared with the prior art update of the entire detection engine. The smooth upgrade of the various functional components of the detection engine on the next-generation firewall and the existing service traffic are realized. The security check is not affected. BRIEF DESCRIPTION OF THE DRAWINGS In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, a brief description of the drawings used in the embodiments or the prior art description will be briefly described below. The drawings are some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings without any inventive labor. 1 is a flowchart of Embodiment 1 of a method for upgrading a detection engine in a firewall device according to the present invention; FIG. 2 is a schematic diagram of an application scenario of Embodiment 1 of a method for upgrading a detection engine in a firewall device according to the present invention;

3 is a schematic diagram 1 of a functional component upgrade state in Embodiment 1 of a method for upgrading a detection engine in a firewall device according to the present invention;

FIG. 4 is a second schematic diagram of a functional component upgrade state according to Embodiment 1 of a method for upgrading a detection engine in a firewall device according to the present invention;

FIG. 5 is a third schematic diagram of a functional component upgrade state according to Embodiment 1 of a method for upgrading a detection engine in a firewall device according to the present invention;

FIG. 6 is a schematic structural diagram of Embodiment 1 of a device for upgrading a detection engine in a firewall device according to the present invention; FIG. 7 is a schematic structural diagram of Embodiment 2 of a device for upgrading a detection engine in a firewall device according to the present invention; A schematic diagram of the structure of the first example. The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. The embodiments are a part of the embodiments of the invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

1 is a flowchart of Embodiment 1 of a method for upgrading a detection engine in a firewall device according to the present invention. FIG. 2 is a schematic diagram of an application scenario of a method for upgrading a detection engine in a firewall device according to the present invention, and FIG. 3 is a schematic diagram of a firewall device in the present invention. FIG. 4 is a schematic diagram of a functional component upgrade state of a first embodiment of a method for upgrading a detection engine in a firewall device according to the present invention. FIG. FIG. 3 is a schematic diagram of the upgrade status of the functional component in the first embodiment of the upgrade method. The execution body of this embodiment is an upgrade device of the detection engine in the firewall device, and the device can be implemented by software and/or hardware. The solution of this embodiment is applied to a network access device or a network switching device, such as a gateway device, a firewall, and an NGFW.

As shown in FIG. 1, the method in this embodiment may include:

Step 101: Generate a new version of the first functional group according to the software upgrade data packet of the detection engine. And running a new version of the first functional component in the detection engine to detect the first session using the first functional component of the new version, the first session refers to running the new functional version of the first functional component with the firewall device Newly established session.

Specifically, as shown in FIG. 2, the upgrade device of the detection engine in the firewall device of the embodiment may be set in the NGFW, and the NGFW is mainly deployed on the Internet egress and the office network egress to protect the user host of the server and the office network. Based on application identification, NGFW performs security detection on application layer traffic in the network, such as IPS detection, AV detection, and URL filtering. An upgrade server is deployed in the network. If the upgrade server or the NGFW has a software upgrade packet of a new version of the function component of the detection engine, such as an IPS function component, and the detection device of the detection engine detects a functional component in the detection engine, such as If the IPS function component or the AV function component needs to be upgraded, a new version of the first functional component is generated according to the detection engine software upgrade data package, and a new version of the first functional component is run in the detection engine to use the new version. The first functional component detects the first session, and the first session refers to a newly established session with the firewall device after running the first functional component of the new version, if the first functional component of the new version, such as the AV functional component, corresponds to The new signature library also loads updates, such as information including multiple viruses.

In this embodiment, the detection of the upgrade of the function component can be triggered periodically. For example, the upgrade server and the NGFW communication can obtain the version status of each function component of the detection engine in the NGFW in real time, and compare with the version status in the upgrade server to learn whether to upgrade, or If the upgrade server does not communicate with the NGFW, you can manually download the software upgrade package to the NGFW. The upgrade component in the NGFW determines whether the upgrade is required. If multiple functional components need to be upgraded at the same time, each functional component can be upgraded simultaneously or sequentially, that is, after one functional component is upgraded, the next functional component is upgraded.

Step 102: If there is at least one second session, use the first functional component of the old version to detect subsequent messages of the second session until all the second sessions are aged, and the second session refers to running the first version of the new version. A functional component has been established with a firewall device.

Specifically, as shown in FIG. 3, if the second session is a session established with the firewall device when running the first functional component of the new version, such as session 1, the first functional component of the old version, such as the IPS functional component version, is used. The security detection is performed on the subsequent packets of the second session, and the subsequent packets in the second session are the packets that belong to the second session after the first functional component of the new version is run, due to the AV function. The component is not upgraded. The session 1 packet is protected by the IPS function component version 1. After full detection, it is sent to the AV function component version 1 for security detection; if the first session is a newly established session with the firewall device after running the first version of the new functional component, such as session 2, the first functional component of the new version is used. For example, the IPS function component version 2 performs security detection on the first session. As shown in FIG. 4, if the AV function component is upgraded to generate a new version 2 and is already running in the detection engine before being sent to the AV function component, the session 2 The message will be checked using the new version of the function component AV function component version 2, as shown in Figure 3. If the AV function component is not upgraded, continue to use the AV function component version 1 for security detection.

In this embodiment, as shown in FIG. 3, after session flow distribution is performed, application identification is performed, that is, application identification is performed on the received message to find a corresponding functional component for security detection. Figure 3 shows the IPS function component and the AV function component as examples. The actual application can include more functional components, such as URL filtering function components and DLP function components. After the security check is performed, the corresponding actions are performed according to the result of the security check, such as blocking, alarm, log, release, and the like.

Step 103: After all the second sessions are aged, destroy the first functional component of the old version.

Specifically, as shown in FIG. 5, after the session that has been established with the firewall device before the running of the new version of the first functional component in the detection engine is aging, the functional component of the old version of the detection engine used by the session 1 is destroyed. For example, the IPS function component version 1 and session 2 continue to use the IPS function component version 2 and the AV function component version 1 for security detection. The aging refers to a transmission control protocol (TCP) connection. FIN or connection reset RST message. If the upgrade device of the subsequent detection engine detects that the IPS function component in the detection engine needs to be upgraded again, a new version of the first functional component, such as the IPS function component version 3, is generated in the detection engine according to the obtained software upgrade data packet. And run this function component. At this time, the newly established session 3 uses the new IPS function component version 3 and the AV function component version 2 for security detection. When session 2 ages (and no other session uses IPS function component version 2 and AV function) The component version 1 is detected.) The IPS function component version 2 and the AV function component version 1 in the detection engine used by the session 2 are destroyed.

The "first" and "second" in the first functional component, the second functional component, the first session, and the second session in this embodiment are not meant to represent a sequential relationship, but to distinguish different functional components and sessions, The first, second, etc. mentioned in the file are also used to distinguish between different components, versions, sessions, and so on.

In this embodiment, a new version of the first functional component is generated according to the software upgrade data packet of the detection engine, and the new functional version of the first functional component is used in the detection engine for use. The first functional component of the new version detects the first session, where the first session refers to a session newly established with the firewall device after running the new functional component of the new version; if there is at least one second In the session, the first function component of the old version is used to detect subsequent messages of the second session until all the second sessions are aged, and the second session refers to running the first function of the new version. The component has been established with the firewall device; after all the second sessions are aged, the first functional component of the old version is destroyed, because only the corresponding functional component that needs to be upgraded is upgraded instead of the entire detection engine. The upgrade is performed, and after all the second sessions are aged, the functional components of the old version that detect the second session are destroyed, the resource occupation is small, and the upgrade efficiency is high, and the functions of the detection engine on the next-generation firewall are implemented. The smooth upgrade of components and the security detection of existing traffic are not affected.

In the second embodiment of the method for upgrading the detection engine in the firewall device of the present invention, in the foundation of the method embodiment shown in FIG. 1, the method may further include:

If the packet of the first session is used, the first functional component of the new version is applied for detection; if the packet belongs to the second session, the first functional component of the old version is used for detection.

Specifically, as shown in FIG. 3, the NGFW receives the packet, and determines, according to the packet header of the packet, the packet that belongs to the first session, such as session 2, or the packet that belongs to the second session, such as session 1. If the session is in the session 2, the first function component of the new version, such as the IPS function component version 2, is applied. If the second session is the session 1, the first functional component of the old version, such as the IPS function, is applied. Component version 1 is tested.

Further, if there is at least one second session, the subsequent function of the second session is detected by using the first functional component of the old version, until all the second sessions are aged, before the embodiment is The method also includes:

Establishing and storing a correspondence between the first functional component of the old version, the second session, and the session state of the second session, so as to determine whether all of the second sessions are aging;

Optionally, the correspondence between the first version of the first functional component, the first session, and the session state of the first session may be established and stored, so that when the first functional component is upgraded again, Whether a session is aging or not.

Specifically, as shown in FIG. 3, for example, in the upgrade device of the detection engine in the firewall device, for example, Establish and store: IPS function component version 1 and AV function component version 1, session 1 and session 1 session state correspondence, IPS function component version 2 and AV function component version 1, session 2 and session 2 session state correspondence Relationship, as shown in Figure 4, the correspondence between Session 2 and IPS function component version 2 and AV function component version 2, as shown in Table 1, for judging whether all sessions are aging, it is convenient to judge whether each functional component is destroyed. And which version of the functional component of the subsequent message of the session is used for security detection, as shown in Table 1, the first column represents the correspondence number, the second column represents the functional component version, the third column represents the session, and the fourth column represents the session state. .

Table 1

Further, after receiving the packet, the method may further include:

When the flag of the message is the end connection FIN or the connection reset RST, if the session is the second session, the session belongs to the >3⁄4 text in the corresponding relationship. The session state is set to the aging state.

Optionally, if the session is the first session, the session state of the session to which the message belongs is set to an aging state in the corresponding relationship.

Specifically, as shown in Table 1, when the flag of the sent service message is the end connection FIN or the connection reset RST, and the session to which the message belongs is session 1, the corresponding relationship corresponding to the session 1 is The session state in 2 is set to the aging state. If no other sessions are detected using the IPS function component version 1, all the sessions detected by using the IPS function component version 1 are aged, so the IPS function component version is used. 1 Destroy, the packets of the newly established session are detected by the IPS function component version 2 and the AV function component version 1. Further, the method may further include:

If the software upgrade package further includes an upgrade package of at least one second functional component, a new version of the second functional component is generated, and a new version of the second functional component is run in the detection engine.

Specifically, if the software upgrade data package further includes an upgrade data package of the at least one second function component, such as an upgrade data package including the IPS function component and the AV function component, generating a new version of the first function component, such as an IPS function component. Version 2 and generating a new version of the second functional component such as the AV function component version 2, and running the new version of the second functional component in the detection engine; if the software upgrade package also includes the upgrade package of the two second functional components For example, the AV function component and the upgrade package of the DLP function component generate two new versions of the second function component such as the AV function component version 2 and the DLP function component version 2.

In this embodiment, the correspondence between the first version of the first functional component, the first session, and the session state of the first session is established and stored, so as to determine whether all the first sessions are aged, and establish and store the old Corresponding relationship between the first functional component of the version, the second session, and the session state of the second session, for judging whether all of the second sessions are aging; receiving the packet, determining the packet according to the packet header of the packet If the packet belongs to the first session, the packet belongs to the first session, and if the packet belongs to the second session, the first function component of the new session is used for detecting, and if the packet belongs to the second session, the old application is applied. The first functional component of the version is detected. When the flag of the message is the end connection FIN or the connection reset RST, the session state of the session to which the message belongs is set to an aging state, and at least one of the software upgrade data packets is included. The upgrade package of the second functional component generates a new version of the second functional component, and runs a new version of the second functional component in the detection engine. Source occupy a smaller, high-efficiency upgrade, to achieve a smooth upgrade safety testing and has not affected the various functional components of the detection engine on a next-generation firewall traffic flow.

FIG. 6 is a schematic structural diagram of Embodiment 1 of an apparatus for upgrading a detection engine in a firewall device according to the present invention. As shown in FIG. 6, the apparatus 50 of this embodiment may include: an installation module 501, a detection module 502, and a destruction module 503, where The module 501 is configured to generate a new version of the first functional component according to the software upgrade data package of the detection engine, and run the new version of the first functional component in the detection engine; the detection module 502 is configured to use the The first functional component of the new version generated and executed by the installation module 501 detects the first session, where the first session refers to a newly established session with the firewall device after running the new functional component of the new version. The detecting module 502 is further configured to: if there is at least one second session, use the first functional component of the old version to the second session The subsequent message of the voice is detected until all the second sessions are aged, and the second session refers to a session that has been established with the firewall device when the first functional component of the new version is run; According to the triggering of the detecting module 502, after all the second sessions are aged, the first functional component of the old version is destroyed.

The device in this embodiment can be used to implement the technical solution of the method embodiment shown in FIG. 1. The principle and the technical effect are similar, and details are not described herein again.

FIG. 7 is a schematic structural diagram of Embodiment 2 of a device for upgrading a detection engine in a firewall device according to the present invention. As shown in FIG. 7, the device 50 of the present embodiment may further include: The receiving module 504 is configured to receive a packet, and determine, according to the packet header of the packet, the packet that belongs to the first session or the packet that belongs to the second session. The detecting module 502 is further configured to: if the packet belongs to the first session, apply the first functional component of the new version for detection; if the packet belongs to the second session, apply the old version The first functional component is tested.

Further, the apparatus of this embodiment may further include:

a storage module 505, configured to establish and store a correspondence between the first functional component of the old version, the second session, and the session state of the second session, for the detection module to Whether the second session is aging or not is judged.

Optionally, the storage module 505 is further configured to establish and store a correspondence between the first functional component of the old version, the first session, and the session state of the first session, for the detection module to Whether all of the first sessions are aged or not is judged.

The storage module 505 is further configured to:

When the flag of the message received by the receiving module 504 is the end connection FIN or the connection reset RST, if the session to which the message belongs is the second session, the storage module 505 stores In the corresponding relationship, the session state of the session to which the message belongs is set to an aging state.

Optionally, the storage module 505 is further configured to:

When the flag of the message received by the receiving module 504 is the end connection FIN or the connection reset RST, if the session to which the message belongs is the first session, the storage is stored in the storage module 505. In the corresponding relationship, the session state of the session to which the message belongs is set to an aging state.

Optionally, the installation module 501 is further configured to:

If the software upgrade data package further includes an upgrade data packet of at least one second functional component, A new version of the second functional component is then generated and the new version of the second functional component is run in the detection engine.

The device in this embodiment may be used to implement the technical solution in the second embodiment of the method, and the implementation principle and the technical effect are similar, and details are not described herein again.

FIG. 8 is a schematic structural diagram of Embodiment 1 of an upgrade device of a detection engine according to the present invention. As shown in FIG. 8, the upgrade device 70 of the detection engine provided in this embodiment includes a bus 701, a receiver 702, a processor 703, and a memory 704. The bus 701 is used to connect the receiver 702, the processor 703 and the memory 704, and to transmit information; the receiver 702 is configured to receive the message, and the memory 704 stores the execution instruction. When the upgrade device 70 of the detection engine is running, the processor 703 In communication with the memory 704, the processor 703 runs the code stored in the memory 704 and performs the following operations:

Generating a new version of the first functional component according to the software upgrade data package of the detection engine, and running the new version of the first functional component in the detection engine to use the new version of the first functional component pair a session is detected, where the first session refers to a session newly established with the firewall device after running the new functional component of the new version;

Preferably, if there is at least one second session, the subsequent function of the second session is detected by using the first functional component of the old version, until the storage of all the second sessions is before the memory 704 Also used for:

Optionally, the memory 704 is further configured to establish and store a correspondence between the first version of the first functional component, the first session, and the session state of the first session, for performing aging on all of the first sessions. Judge.

Optionally, the processor 703 is further configured to determine, according to the packet header of the packet of the receiver 702, the packet that the packet belongs to the first session, or the packet that belongs to the second session. If the packet belongs to the first session, the first functional component of the new version is applied for detection; and if the packet belongs to the second session, the first functional component of the old version is applied. Check Measurement.

Optionally, the processor 703 is further configured to: when the flag of the message received by the receiver 702 is an end connection FIN or a connection reset RST, if the message belongs to the session In the second session, the session state of the session to which the message belongs is set to an aging state in the corresponding relationship.

Optionally, the processor 703 is further configured to:

When the flag of the message received by the receiver 702 is the end connection FIN or the connection reset RST, if the session to which the message belongs is the first session, in the corresponding relationship The session state of the session to which the packet belongs is set to an aging state.

Optionally, the processor 703 is further configured to:

The device in this embodiment may be used to implement the technical solution of the method embodiment, and the implementation principle and the technical effect are similar, and details are not described herein again.

In the several embodiments provided by the present invention, it should be understood that the disclosed apparatus and method may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be electrical, mechanical or otherwise.

The units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

The above integrated unit implemented in the form of a software functional unit can be stored in a computer Readable in storage media. The software functional unit is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor to perform the method of various embodiments of the present invention. Part of the steps. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program code. .

A person skilled in the art can clearly understand that for the convenience and brevity of the description, only the division of each functional module described above is exemplified. In practical applications, the above function assignment can be completed by different functional modules as needed, that is, the device is installed. The internal structure is divided into different functional modules to perform all or part of the functions described above. For the specific working process of the device described above, refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

It should be noted that the above embodiments are merely illustrative of the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art The technical solutions described in the foregoing embodiments may be modified, or some or all of the technical features may be equivalently replaced; and the modifications or substitutions do not deviate from the technical solutions of the embodiments of the present invention. range.

Claims

Rights request

1. A method for upgrading a detection engine in a firewall device, characterized by: generating a new version of the first functional component according to the software upgrade data package of the detection engine, and running the new version in the detection engine. The first functional component of the new version is used to detect the first session using the first functional component of the new version. The first session refers to a new session with the firewall device after running the first functional component of the new version. Established session;

If there is at least one second session, use the first functional component of the old version to detect subsequent messages of the second session until all the second sessions age. The second session refers to running the The first functional component of the new version is the session that has been established with the firewall device;

After all the second sessions are aged out, the old version of the first functional component is destroyed.

2. The method according to claim 1, characterized in that, after running the new version of the first functional component in the detection engine, it further includes:

Receive the message, and determine according to the message header of the message that the message belongs to the first session or the second session;

If the message belongs to the first session, the first functional component of the new version is used for detection; if the message belongs to the second session, the first functional component of the old version is used for detection.

3. The method according to claim 2, wherein if at least one second session exists, the first functional component of the old version is used to detect subsequent messages of the second session until all Before the second session ages out, it also includes:

Establish and store the corresponding relationship between the first functional component of the old version, the second session, and the session state of the second session, so as to determine whether all the second sessions are aged.

4. The method according to claim 3, characterized in that, after receiving the message, it further includes:

When the flag bit of the text is the connection end FIN or the connection reset RST, if the session to which the text belongs is the second session, then the session to which the text belongs is set in the corresponding relationship. session The status is set to aging status.

5. The method according to any one of claims 1 to 4, further comprising: if the software upgrade data package also includes an upgrade data package of at least one second functional component, generating a new version of the second functional component. a second functional component, and run the new version of the second functional component in the detection engine.

6. An upgrade device for a detection engine in a firewall device, characterized in that it includes: an installation module, configured to generate a new version of the first functional component according to the software upgrade data package of the detection engine, and install it on the detection engine Run the first functional component of the new version;

A detection module, configured to use the first functional component of the new version generated and run by the installation module to detect the first session, where the first session refers to the first session after running the first functional component of the new version. The newly established session of the firewall device;

The detection module is also configured to, if at least one second session exists, use an old version of the first functional component to detect subsequent messages of the second session until all the second sessions age out, The second session refers to the session that has been established with the firewall device when running the first functional component of the new version;

A destruction module, configured to destroy the old version of the first functional component after all the second sessions have aged out according to the triggering of the detection module.

7. The device according to claim 6, characterized in that, the device further includes: a receiving module, configured to receive a message, and determine that the message belongs to the first session according to the message header of the message. messages, or messages belonging to the second session;

The detection module is also configured to apply the first functional component of the new version for detection if the message belongs to the first session; if the message belongs to the second session, apply the old version The first functional component is detected.

8. The device according to claim 7, wherein the device further includes: a storage module, configured to establish and store an old version of the first functional component, the second session, and the session of the second session. The corresponding relationship between the three states is used by the detection module to determine whether all the second sessions are aged.

9. The device according to claim 8, wherein the storage module is further configured to: when the flag bit of the message received by the receiving module is FIN or RST, if the session to which the message belongs is the second session, then in the corresponding relationship, the session state of the session to which the "text" belongs is set to the aging state.

10. The device according to any one of claims 6 to 9, characterized in that the installation module is also used for:

If the software upgrade data package also includes an upgrade data package of at least one second functional component, a new version of the second functional component is generated, and the new version of the second functional component is run in the detection engine.